Install via docker compose

Clone the upstream and use the bundled compose:

git clone https://github.com/danny-avila/LibreChat.git
cd LibreChat

cp .env.example .env
cp librechat.example.yaml librechat.yaml

# Edit .env — the minimum is to add at least one provider API key
nano .env

Minimum env values:

# Encryption keys — generate with: openssl rand -hex 32
CREDS_KEY=<32-byte hex>
CREDS_IV=<16-byte hex>
JWT_SECRET=<long-random>
JWT_REFRESH_SECRET=<long-random>

# At least one provider
OPENAI_API_KEY=sk-...
ANTHROPIC_API_KEY=sk-ant-...
GOOGLE_KEY=...
OLLAMA_BASE_URL=http://host.docker.internal:11434

# App
DOMAIN_CLIENT=https://chat.example.com
DOMAIN_SERVER=https://chat.example.com
ALLOW_REGISTRATION=true       # disable after first user is set up
ALLOW_EMAIL_LOGIN=true
docker compose up -d
docker compose logs -f api

The frontend is at http://<host>:3080. Sign up (first user becomes admin), then add models in the settings or via librechat.yaml.

Reverse proxy

# Caddy
chat.example.com {
    reverse_proxy 127.0.0.1:3080
    request_body { max_size 100MB }
}

WebSockets are used for streaming responses; Caddy handles them automatically.

Configure providers via librechat.yaml

For more than basic provider toggles, the YAML config defines every model, endpoint, default parameters, and per-endpoint feature gates:

version: 1.1.7
cache: true

endpoints:
  custom:
    - name: "Groq"
      apiKey: "${GROQ_API_KEY}"
      baseURL: "https://api.groq.com/openai/v1/"
      models:
        default: ["llama-3.3-70b-versatile", "mixtral-8x7b-32768"]
      titleConvo: true
      titleModel: "llama-3.3-70b-versatile"
      modelDisplayLabel: "Groq"

    - name: "Local Ollama"
      apiKey: "ollama"
      baseURL: "http://host.docker.internal:11434/v1"
      models:
        default: ["qwen2.5-coder:32b", "llama3.3:70b"]
      titleConvo: false
      modelDisplayLabel: "Local"

  openAI:
    apiKey: "${OPENAI_API_KEY}"
    models:
      default: ["gpt-5", "gpt-5-mini", "o3-mini"]

  anthropic:
    apiKey: "${ANTHROPIC_API_KEY}"
    models:
      default: ["claude-opus-4-7", "claude-sonnet-4-6", "claude-haiku-4-5-20251001"]

interface:
  customWelcome: "Welcome to our team's chat. Pick a model in the top-right."
  endpointsMenu: true
  modelSelect: true
  parameters: true            # let users tweak temperature, max tokens, etc.
  sidePanel: true
  presets: true
  bookmarks: true

After editing the YAML, docker compose restart api to pick up changes.

File uploads & RAG

LibreChat supports per-conversation file uploads — documents are chunked, embedded, and inserted as context on subsequent messages. By default the embedding store is in-memory; for persistent RAG across sessions, configure the rag_api service:

# In docker-compose.override.yml
services:
  rag_api:
    image: ghcr.io/danny-avila/librechat-rag-api-dev-lite:latest
    environment:
      DB_HOST: vectordb
      RAG_PORT: 8000
      EMBEDDINGS_PROVIDER: openai            # or "ollama", "huggingfacetei"
      EMBEDDINGS_MODEL: text-embedding-3-small
    depends_on: [ vectordb ]

  vectordb:
    image: ankane/pgvector:latest             # Postgres + pgvector (see /tutorials/postgres-pgvector-embeddings.html)
    environment:
      POSTGRES_USER: rag
      POSTGRES_PASSWORD: ${RAG_DB_PW}
      POSTGRES_DB: rag

For everything-stays-local RAG, point the embeddings model at an Ollama instance with nomic-embed-text or mxbai-embed-large — works the same.

Tool calls / plugins

LibreChat supports OpenAI-style tool/function calling and plugins. Built-in plugins:

  • Browsing (via Serper / Tavily / Google CSE)
  • DALL-E / Stable Diffusion image generation
  • Code interpreter
  • Calculator
  • Wolfram Alpha

Plus a "Custom Endpoint" plugin for OpenAPI-spec-defined APIs (point at any OpenAPI URL; LibreChat exposes its operations as callable tools).

SSO & auth

For team use, swap default email/password for SSO. LibreChat supports OAuth (Google, GitHub, Discord, Facebook, Apple) and full OpenID Connect (Authentik in that tutorial works perfectly):

OPENID_CLIENT_ID=<authentik-client-id>
OPENID_CLIENT_SECRET=<authentik-client-secret>
OPENID_ISSUER=https://auth.example.com/application/o/librechat/
OPENID_SESSION_SECRET=<random>
OPENID_SCOPE="openid profile email"
OPENID_CALLBACK_URL=/oauth/openid/callback
OPENID_BUTTON_LABEL="Sign in with Authentik"
OPENID_IMAGE_URL=https://auth.example.com/static/images/icons/icon-32x32.png

Set ALLOW_EMAIL_LOGIN=false after SSO is configured to require SSO for all new users.

Cost discipline

LibreChat tracks per-user token use and per-conversation cost (in the latest releases). For per-user spending limits, the admin panel has rate limits and conversation length caps. For per-organization budget tracking, pair with the LiteLLM proxy: configure LibreChat to point at a LiteLLM endpoint, which fans out to the real providers and enforces spending caps centrally.

Backups

  • MongoDB (LibreChat's default DB) — mongodump nightly.
  • The ./uploads/ directory — user-uploaded files.
  • The ./meili_data/ directory (LibreChat uses MeiliSearch for conversation search; see that tutorial).
  • .env + librechat.yaml — out-of-band.

Alternatives

  • Open WebUI (formerly Ollama WebUI) — smaller scope, focused on local Ollama. Great if Ollama is your only backend.
  • AnythingLLM — more workspace-/RAG-focused; treats documents as first-class.
  • BetterChatGPT / Lobe Chat — lighter clients; less feature-rich than LibreChat for team use.

For "we want our team's interactions with every LLM behind one URL we control, with cost tracking and audit log," LibreChat is the most complete option in 2026.